3.5 Configure Parsing Rules XDR-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which outcome is achieved by applying a parsing rule to raw log data?

   • ARaw log entries are deleted after successful parsing
   • BLogs are automatically forwarded to an external SIEM
   • CLogs are compressed to reduce storage footprint
   • DFields such as source IP and username become searchable and usable in detection rules
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   When testing a parsing rule, what should you observe in the test results to confirm the rule is working correctly?

   • AThe extracted values appear in the correct normalized fields
   • BThe rule generates an alert for the sample log
   • CThe sample log is deleted from the system
   • DThe log source is automatically updated
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A team is creating a parsing rule for a log source that emits JSON-formatted logs. The log contains nested objects, such as {'user': {'name': 'jdoe', 'id': 123}, 'action': 'login'}. They need to extract 'user.name' into the normalized field 'username'. What is the correct approach in the XDR parsing rule interface?

   • ACreate a separate parsing rule for each nested field.
   • BUse the built-in JSON parser and specify the field path 'user.name' in the field mapping.
   • CUse a regex pattern that matches the nested JSON structure, such as '"name":"(?<username>\S+)"'.
   • DFlatten the JSON manually in the extraction pattern using a custom delimiter.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which component of a parsing rule defines the conditions that must be met for the rule to apply to a log?

   • AMatch conditions
   • BExtraction patterns
   • CField mappings
   • DTransformation functions
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company ingests logs from a legacy system that uses a non-standard format. The logs contain fields like 'src=192.168.1.1' and 'dst=10.0.0.2', but the detection rules expect 'source_ip' and 'destination_ip'. What is the purpose of creating a parsing rule for this log source?

   • ATo compress the logs to reduce storage costs.
   • BTo filter out logs that are not relevant to security.
   • CTo encrypt the logs to protect sensitive data.
   • DTo convert the logs to a standard format that detection rules can use.
   Reveal Solution Discussion Select an answer first